Microsoft discovered that an old version of the SHEIN Android application periodically read the contents of the Android device clipboard and, if a particular pattern was present, sent the contents of the clipboard to a remote server. While we are not specifically aware of any malicious intent behind the behavior, we assessed that this behavior was not necessary for users to perform their tasks on the app.
SHEIN’s Android application is published on the Google Play Store with over 100 million downloads. Even if SHEIN’s clipboard behavior involved no malicious intent, this example case highlights the risks that installed applications can pose, including those that are highly popular and obtained from the platform’s official app store. We reported our findings to Google, the Play Store operator, leading to an investigation by their Android Security Team. In May 2022, Google informed us and we confirmed that SHEIN removed the behavior from the application. We would like to thank Google’s Android Security Team as well as the SHEIN team for their efforts and collaboration in addressing this issue. We would also like to thank the Google team for the improvements implemented to the Android platform to protect users from the risks associated with anomalous clipboard access.
In this blog, we detail how we identified the SHEIN app’s clipboard behavior and how Android users can protect themselves against clipboard-based attacks. We also share this research with the larger security community to emphasize the importance of collaboration in the effort to improve security for all.
Static and dynamic analysis
The following analysis details how we identified and verified the presence of the SHEIN app’s clipboard behavior, analyzing SHEIN app version 7.9.2 (SHA-256: ff07dc6e237acd19cb33e35c60cb2ae52c460aac76bc27116d8de76abec66c51). We first performed a static analysis of the app to identify the relevant code responsible for the behavior. We then performed a dynamic analysis by running the app in an instrumented environment to observe the code, including how it read the clipboard and sent its contents to a remote server.
Identifying the code
Upon opening the application, the launcher activity com.shein.user_service.welcome.WelcomeActivity extends the com.zzkko.base.ui.BaseActivity class, which performs a call to the iBaseActivityCallBack.h method in the onResume callback, depicted below on Line 11:
The com.zzkko.app.iBaseActivityCallBackis aninterfaceimplemented by the com.zzkko.app.BaseActivityCallBack. The method h, partially depicted below, from the previous call performs a call to the method o in the same class, as shown on Line 16:
Finally, in thecom.zzkko.app.BaseActivityCallBack.o method there is a call to the com.zzkko.util.MarketClipboardPhaseLinker.f method, shown on Line 2:
Method com.zzkko.app.BaseActivityCallBack.f, depicted below, checks whether the character sequences “$” and “://” are present in the clipboard text, depicted on Line 6. If both are present, method k in the same class is called with the clipboard text provided as a parameter, as shown on Line 8:
Method com.zzkko.app.BaseActivityCallBack.kinitiates a flow that performs a POST request to the server at BaseUrlConstant.APP_URL + “/marketing/tinyurl/phrase”, which resolves to https://api-service[.]shein[.]com/marketing/tinyurl/phrase:
Since all of the application’s activities (user interfaces) extend com.zzkko.base.ui.BaseActivity, the call chain described above was triggered any time the user launched a new activity, such as by starting or resuming the application or performing certain actions within the app.
Verifying the code’s clipboard behavior
To verify our static analysis findings, we performed a dynamic analysis of the application, which we installed from the Google Play Store onto a Samsung device running Android 9.
We used Frida to intercept calls to the android.content.ClipboardManager.getText and com.zzkko.util.MarketClipboardPhaseLinker.f methods to analyze the application’s clipboard behavior. We also used Frida to bypass the application’s certificate pinning to enable us to analyze network traffic using Burp Proxy.
We set the contents of the device clipboard to https://mybank[.]com/token=secretToken&transaction=100$ and opened the application.
Upon opening the application, the following calls were logged:
In Figure 7 above, we observe the following:
Lines 28: Call to the function com.zzkko.util.MarketClipboardPhaseLinker.f
Lines 29-49: Stack trace to the function com.zzkko.util.MarketClipboardPhaseLinker.f
Lines 53, 55: Calls to the hasPrimaryClip and getPrimaryClip methods of the ClipboardManager
Finally, a POST request to api-service[.]shein[.]com is performed. Subsequently, we captured the following request in Burp Proxy, showing the transmission of the clipboard contents to the remote server:
Android clipboard protections
As displayed in this case involving SHEIN, Android applications can call the android.text.ClipboardManager API to read from or write to the device clipboard without requesting the user’s approval or requiring any specific Android permission. While calling the ClipboardManager API can allow apps to make processes easier for users, such as quickly selecting text to copy, applications often should not need to do this since copying and pasting is typically performed by the device input method editor (keyboard), which is a separate application.
To address our research findings and the broader issue at hand, Google has recognized the risks associated with clipboard access and has made the following improvements to the Android platform to protect users:
Users can protect themselves by watching out for the clipboard access message. If the message unexpectedly shows, they should assume that any data on the clipboard has been potentially compromised, and they should consider removing any applications that make suspicious clipboard accesses.
Responsible disclosure and industry collaboration improves security for all
Although we’re not aware of any malicious intent by SHEIN, even seemingly benign behaviors in applications can be exploited with malicious intent. Threats targeting clipboards can put any copied and pasted information at risk of being stolen or modified by attackers, such as passwords, financial details, personal data, cryptocurrency wallet addresses, and other sensitive information.
We recommend users further follow the security guidelines below to defend against this and similar risks:
Always keep the device and the installed applications updated
Never install applications from untrusted sources
Consider removing applications with unexpected behaviors, such as clipboard access toast notifications, and report the behavior to the vendor or app store operator
After discovering the SHEIN Android application clipboard behavior, we worked with Google’s Android Security Team to ensure the removal of this behavior from the app. We thank both the Google and SHEIN teams for their efforts and collaboration in addressing the issue.
At Microsoft, we value, protect, and defend privacy—and this case demonstrates our efforts to investigate and protect customers’ privacy beyond security threats. As the threat landscape continues to evolve, Microsoft strives to continuously improve security for all through research-driven protection and collaboration with customers, partners, and industry experts, regardless of the device or platform in use.
We will continue to work with the security community to share research and intelligence about risks and threats in the effort to build better protection for all.
Dimitrios Valsamaras, Michael Peck Microsoft 365 Defender Research Team
A fake mobile banking rewards app delivered through a link in an SMS campaign has been making the rounds, targeting customers of Indian banking institutions. Users who install the mobile app are unknowingly installing an Android malware with remote access trojan (RAT) capabilities.
Microsoft discovered a high-severity vulnerability in the TikTok Android application, now identified as CVE-2022-28799 and fixed by TikTok, which could have allowed attackers to compromise users' accounts with a single click.
Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve.
Microsoft uncovered high-severity vulnerabilities in a mobile framework used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote or local attacks.